The invention relates to a control device and, more particularly, to a control device especially for vehicle braking light control including a control unit that emits an output signal to control a controllable element. The signal, when a control command signal applied on the input side is at an activating signal level, receives an activating signal level continuously or periodically. When the control command signal is at a deactivating signal level or a functional failure of the control unit occurs, the signal assumes a deactivating signal level.
A device of this kind can be used especially for controlling the brake light or lights of a vehicle, with the at least one brake light forming the controllable element that is controlled by a control unit as a function of the control command signal generated in a brake light switch. In order to be able to operate the brake light with different brightnesses when necessary, a pulse-width modulatable clock pulse signal can be provided as a control signal. This type of control for vehicle lights is described for example in German Patent documents DE 43 08 514 A1 and DE 43 41 058 C1.
A device for controlling and monitoring the brake lights of a vehicle as a function of the control state of a brake light switch is known from German Patent document DE 39 30 775 A1, in which the signal generated in a brake light switch is fed to a control and regulating unit that directs a corresponding electrical current to generate the braking light in the brake lights as a function of this signal. At the same time, the functioning ability of the brake lights is monitored by the control and regulating unit, for which purpose it is additionally supplied with the signal from a wheel speed sensor. In the event of a lack of functional ability or detection of braking with an open brake light switch or with brake lights that fail to light up, an error message is generated. The control and regulating unit preferably contains two processors connected in parallel to achieve a reliability-increasing redundancy, said processors, among other things, monitoring the function of an antilock brake system provided in the vehicle. In order to ensure that the brake lights remain supplied with electrical current even if the control and regulating unit should completely fail, it is proposed to arrange an electrical current path with a resistance parallel to the control and regulating unit and between the brake light switch and the brake lights. The resistance is so dimensioned that when the brake light switch is closed the entire current required to activate the brake lights flows through this current path if the control and regulating unit has failed, so that the current path leading from the latter to the brake lights is interrupted.
It is generally known in connection with control devices that incorporate a computer, that in the event of software errors or other problems, the computer can fail even when a so-called watchdog circuit is present, so that the tasks that it is to perform are no longer correctly performed. This situation can have a dangerous adverse effect upon functions that are relevant to safety. It is known in this connection to bring the computer to a defined secure state if it fails, but a state that is completely independent of the input signals and consequently can be improperly adapted to the current situation, for example a general activation of the low beams when the headlights of a vehicle are controlled. It is conventional to design the control device to be redundant as a reliability-increasing measure in such fashion that two or more computer units are used that are functionally identical and operate in parallel, resulting in a corresponding increased cost of implementation; see for example the magazine article by S. Storandt and O. Feger: "How Can Processor and Controller Systems Be Made More Failure-Resistant?" Elektronik, Volume 17, Aug. 19, 1988, page 72.
The technical problem which the present invention is concerned with is the provision of a control device of the above-mentioned type, in which, with the lowest possible expense, a redundancy is created in order to increase the reliability and availability of the device.
This problem is solved by a control device especially for vehicle braking light control including a control unit that emits an output signal to control a controllable element. The signal, when a control command signal applied on the input side is at an activating signal level, receives an activating signal level continuously or periodically. When the control command signal is at a deactivating signal level or a functional failure of the control unit occurs, the signal assumes a deactivating signal level. A redundancy logic unit logically links the control command signal with the output signal of the control unit in such fashion as to form the control signal for the controllable element such that when the output signal of the control unit is continuously at its deactivating signal level, the control signal is at its activating level with the control command signal at its activating signal level. The control signal is at its deactivating level when the control command signal is at its deactivating signal level. Otherwise, the control signal is at its activating or deactivating signal level in accordance with the output signal of the control unit.
In this device, a redundancy device in the form of a simple redundancy logic unit is provided that logically links the control command signal with the output signal of the control unit to form the control signal for the controllable element in such fashion that when the output signal of the control unit is continuously at the deactivating signal level, the control signal, in accordance with the control command signal, is at its activating or deactivating signal level, while otherwise the control signal has a signal level that follows that of the output signal of the control unit. Such a redundancy logic unit clearly requires much less implementation expense than providing two or more parallel control units. It is understood that the terms "activating and deactivating signal level" refer to a level that requires activation or deactivation of the controllable element to be performed. The activating signal level for the various signals does not have to be a uniform level, but can have a low level for one signal and a high level for another signal for example. The same applies to the deactivating signal level.
Advantageously, the redundancy logic unit meets the requirements imposed on a control device of the present type in a relatively simple fashion. If the control unit is functionally reliable, when the control command signal applied on the input side is at the activating signal level, it delivers an output signal that, depending on the individual application and the corresponding system design, is located continuously, or in the form of a clock pulse signal, but in any event during certain periodic intervals, at the activating signal level. This means that the controllable element is activated in a desired fashion. As long as this situation prevails, the redundancy logic unit permits the activation or deactivation requirement of this output signal of the control unit for the control signal of the controllable element to go through. When the output signal of the control unit is located continuously at the deactivating signal level, although the requesting control command signal is at the activating signal level, the redundancy logic unit interprets this as a failure of the control unit and in this case maintains an emergency operation of the controllable element by virtue of the fact that it uses the respective activating or deactivating requirement, as contained in the control command signal, as the control signal of the controllable element. For example, in a control device for controlling the vehicle braking light, in the event of failure of the control unit which normally controls the brake lights, with a pulse-width modulated clock pulse signal and with a variable brightness if necessary, the brake lights are switched by the redundancy logic unit at least to their maximum brightness state when the corresponding brake light switch is closed.
In an advantageous embodiment of the invention, the redundancy logic unit contains an RC element which, in a manner that is simple from a circuitry standpoint, ensures that in the application in which the output signal from the control unit is a pulse-width modulated clock pulse signal, the intervals in which this output signal is not at the activating signal level but at the deactivating signal level are not interpreted as a failure of the control unit. The redundancy logic unit determines that such a failure has occurred only when the output signal from the control unit, when the control command signal is at the activating signal level, remains significantly longer than this blanking interval at the deactivating signal level, whereby the time duration relevant for failure detection is determined by the discharge time constant of the RC element.
It is a further advantage of the invention to provide a control device for vehicle braking light control with a low circuit cost.
Other objects, advantages and novel features of the present invention will become apparent from the following detailed description of the invention when considered in conjunction with the accompanying drawings.